CVE-2024-8687: PAN-OS: Cleartext Exposure of GlobalProtect Portal Passcodes
First published: Wed Sep 11 2024(Updated: )
An information exposure vulnerability exists in Palo Alto Networks PAN-OS software that enables a GlobalProtect end user to learn both the configured GlobalProtect uninstall password and the configured disable or disconnect passcode. After the password or passcode is known, end users can uninstall, disable, or disconnect GlobalProtect even if the GlobalProtect app configuration would not normally permit them to do so.
Credit: psirt@paloaltonetworks.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Palo Alto Networks PAN-OS | >=8.1.0<8.1.25 | |
| Palo Alto Networks PAN-OS | >=9.0.0<9.0.17 | |
| Palo Alto Networks PAN-OS | >=9.1.0<9.1.16 | |
| Palo Alto Networks PAN-OS | >=10.0.0<10.0.12 | |
| Palo Alto Networks PAN-OS | >=10.1.0<10.1.9 | |
| Palo Alto Networks PAN-OS | >=10.2.0<10.2.4 | |
| Palo Alto Networks PAN-OS | =11.0.0 | |
| Palo Alto Networks GlobalProtect | >=5.1.0<5.1.12 | |
| Palo Alto Networks GlobalProtect | >=5.2.0<5.2.13 | |
| Palo Alto Networks GlobalProtect | >=6.0.0<6.0.7 | |
| Palo Alto Networks GlobalProtect | >=6.1.0<6.1.2 | |
| Palo Alto Networks GlobalProtect | =6.2.0 | |
| All of | ||
| Palo Alto Networks Prisma Access | ||
| Palo Alto Networks PAN-OS | <10.2.9 |
Remedy
This issue is fixed in PAN-OS 8.1.25, PAN-OS 9.0.17, PAN-OS 9.1.16, PAN-OS 10.0.12, PAN-OS 10.1.9, PAN-OS 10.2.4, PAN-OS 11.0.1, and all later PAN-OS versions. It is also fixed in Prisma Access 10.2.9 and all later Prisma Access versions. To maintain GlobalProtect app functionality for the vulnerable features, we released a corresponding software update for GlobalProtect app 5.1.12, GlobalProtect app 5.2.13, GlobalProtect app 6.0.7, GlobalProtect app 6.1.2, and GlobalProtect app 6.2.1, and all later GlobalProtect app versions. To maintain the ability for end users to use the uninstall password feature and the disable or disconnect passcode feature, you must ensure that you upgrade all GlobalProtect app deployments to a fixed version before you upgrade your PAN-OS software to a fixed version. All fixed versions of GlobalProtect are backwards compatible with vulnerable versions of PAN-OS software. However, fixed versions of PAN-OS software are not backwards compatible with vulnerable versions of GlobalProtect. You can find additional information for PAN-204689 here: https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-release-notes/pan-os-11-1-0-known-and-addressed-issues/pan-os-11-1-0-known-issues Prisma Access customers can open a support case to request an upgrade.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-8687?
CVE-2024-8687 is classified as an information exposure vulnerability in Palo Alto Networks PAN-OS.
How do I fix CVE-2024-8687?
To fix CVE-2024-8687, upgrade to the latest version of Palo Alto Networks PAN-OS or GlobalProtect that addresses this vulnerability.
What are the affected versions for CVE-2024-8687?
CVE-2024-8687 affects multiple versions of Palo Alto Networks PAN-OS and GlobalProtect from version 8.1.0 up to specific higher versions.
What type of vulnerability is CVE-2024-8687?
CVE-2024-8687 is an information exposure vulnerability that allows end users to discover sensitive configuration data.
Is CVE-2024-8687 a remote vulnerability?
CVE-2024-8687 can be exploited by a local user with access to the GlobalProtect client.
- agent/remedy
- agent/title
- agent/references
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/type
- agent/author
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/event
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- vendor/paloaltonetworks
- canonical/palo alto networks pan-os
- version/palo alto networks pan-os/8.1.0
- version/palo alto networks pan-os/9.0.0
- version/palo alto networks pan-os/9.1.0
- version/palo alto networks pan-os/10.0.0
- version/palo alto networks pan-os/10.1.0
- version/palo alto networks pan-os/10.2.0
- version/palo alto networks pan-os/11.0.0
- canonical/palo alto networks globalprotect
- version/palo alto networks globalprotect/5.1.0
- version/palo alto networks globalprotect/5.2.0
- version/palo alto networks globalprotect/6.0.0
- version/palo alto networks globalprotect/6.1.0
- version/palo alto networks globalprotect/6.2.0
- canonical/palo alto networks prisma access